Privacy Policy

1. Introduction

This Privacy Policy explains how ZeraBooks (“ZeraBooks”, “we”, “our” or “us”) collects, uses, discloses and protects personal information when you visit zerabooks.com or use the ZeraBooks web application, including the General Ledger, the Converter and the Ask Zera assistant, and our bookkeeping and enterprise services (together, the “Service”). Capitalized terms not defined here have the meanings given in our Terms of Service.

ZeraBooks is operated from British Columbia, Canada. We handle personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia’s Personal Information Protection Act (PIPA) where they apply, and we provide the rights described below to individuals covered by the EU and UK General Data Protection Regulation (GDPR) and U.S. state privacy laws such as the California Consumer Privacy Act (CCPA), where those laws apply to us.

Accountability: our founder, Damin Mutti, is responsible for ZeraBooks’ compliance with this policy and can be reached at daminmutti@zerabooks.com.

2. Our Role

For information about our own customers and website visitors, such as account, billing and usage information, ZeraBooks decides how the information is used and is responsible for it.

Our customers also upload documents and records that contain personal information about other people, such as their own clients, customers, vendors and employees. For that information, our customer decides why it is processed and ZeraBooks processes it on the customer’s behalf to provide the Service. If your information is in books or documents managed by one of our customers, please contact that customer first. If you contact us, we will refer your request to them and help them respond.

3. Information We Collect

4. How We Use Information

• To provide the Service, including reading and converting your documents, recording and categorizing transactions, reconciling statements, producing reports and answering questions in Ask Zera
• To learn from your corrections within your account and each client company, so that later results for that company are more accurate
• To create and manage your account, authenticate you and manage your subscription and payments
• To send service emails, such as sign-in and password emails, receipts, notices about your account and bookkeeping follow-ups from Zera, and to send emails and reports that you ask the Service to send
• To provide support and respond to your requests
• To provide bookkeeping or enterprise services you have engaged us for
• To understand how the Service is used and to maintain and improve it
• To measure the effectiveness of our advertising
• To protect the Service, detect and prevent fraud, abuse and security incidents, and enforce our Terms
• To comply with legal obligations and respond to lawful requests

We do not currently send marketing emails. If we do in future, we will send them only as permitted by law, including Canada’s Anti-Spam Legislation, and every marketing email will let you unsubscribe.

We do not sell your personal information or Customer Data, and we do not use Customer Data to train general-purpose AI models offered to others.

5. AI Processing

The Service uses AI models to read documents, extract transactions, suggest and check categories, and answer questions. To do this, the relevant content of your documents and records is sent to our AI model providers, which process it to return results to us. The Service does not use AI to make decisions that produce legal or similarly significant effects about individuals. You review and control the results in your books.

6. Legal Basis and Consent

Canada: we collect, use and disclose personal information with your consent, which may be express or implied from your use of the Service, or as otherwise permitted or required by law. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may mean we can no longer provide the Service.

EU and UK: where the GDPR applies, we rely on the following legal bases:

• Contract: processing needed to provide the Service you signed up for
• Legitimate interests: securing, supporting and improving the Service, preventing fraud and abuse, and measuring our advertising, balanced against your rights
• Consent: where we ask for it, which you can withdraw at any time
• Legal obligation: where the law requires us to process information, such as keeping tax records

7. How We Share Information

We share personal information only as described below.

8. International Transfers

ZeraBooks is based in Canada, and our service providers process information in Canada, the United States and other countries. Your information may therefore be stored and processed outside your province, state or country, where it may be accessible to courts, law enforcement and national security authorities under the laws of that jurisdiction. Where the GDPR applies, we rely on adequacy decisions, including the European Commission’s adequacy decision for Canada, and on safeguards such as Standard Contractual Clauses offered by our providers.

9. Cookies, Analytics and Advertising Measurement

We use cookies, local storage and similar technologies for the following purposes:

You can block or delete cookies and local storage through your browser settings. Blocking essential cookies will stop the Service from working properly.

10. Data Retention

We keep personal information only as long as needed for the purposes in this policy or as the law requires:

• Account information: while your account is open and for a reasonable period afterwards, then deleted or de-identified
• General Ledger data: your documents and records are kept as part of your books while your account is open, so your history and reports stay complete. You can delete items where the Service allows it.
• Converter documents: lists in the Converter show the documents uploaded in the last 30 days. Files remain stored on our systems after they leave the lists until your account data is deleted or you ask us to delete them.
• After your account ends: we may delete Customer Data at any time after 90 days, as described in our Terms of Service
• Billing records: for as long as tax and accounting laws require, generally at least six years
• Logs: for limited periods for security and troubleshooting
• Backups: until they are overwritten in the normal course

We may keep information for longer where needed to resolve disputes, enforce our agreements or comply with a legal obligation. You can ask us to delete your account and data at any time by emailing daminmutti@zerabooks.com.

11. Security

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including:

• Encryption of data in transit using TLS
• Encryption of stored data by our database and file storage provider
• Access controls that keep each company’s books separate from every other company’s
• Passwords hashed by our authentication provider
• Card payments handled by Stripe, a PCI-compliant payment processor
• Access to customer information limited to people who need it to provide the Service

We never ask for your online banking login, because the Service has no bank feeds. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach of security safeguards involving your personal information creates a real risk of significant harm, we will notify you and the relevant regulators as required by law.

12. Your Privacy Rights

Depending on where you live, you may have the following rights about your personal information:

To exercise any of these rights, email daminmutti@zerabooks.com. We will verify your identity before acting on a request, and an authorized agent may make a request on your behalf with proof of authority. We respond within the time required by law, normally within 30 days. If we cannot fulfil a request, for example because the law requires us to keep the information, we will explain why.

In Canada, you may also contact the Office of the Privacy Commissioner of Canada or, in British Columbia, the Office of the Information and Privacy Commissioner for British Columbia.

13. Children's Privacy

The Service is intended for business use by people who are at least 18 years old. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child, we will delete it. If you believe we have, please contact us.

14. Third-Party Websites

Our website and the Service may link to third-party websites and services that we do not control. Their privacy practices are governed by their own policies, and we encourage you to read them.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email or by a notice in the Service at least 30 days before the changes take effect. The “Last Updated” date at the top of this page shows when this policy was last revised.

16. Contact Us

For questions, requests or complaints about this Privacy Policy or our handling of personal information, contact: